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We demonstrate that, with a fair comparison, the secret key rate of discrete-variable measurement-device- 
independent quantum key distribution (DV-MDI-QKD) with high-efficiency single-photon detectors and good 
system alignment is typically rather high and thus highly suitable for not only long distance communication 
but also metropolitan networks. The previous reservation on the key rate and suitability of DV-MDI-QKD for 
metropolitan networks expressed by Pirandola et al. [1] was based on an unfair comparison with low-efficiency 
detectors and high quantum bit error rate, and is, in our opinion, unjustified. 


In a recent Article in Nature Photonics, Pirandola et al. [1] 
claim that the achievable secret key rates of discrete-variable 
measurement-device-independent quantum key distribution 
(DV-MDI-QKD) [2] are “typically very low, unsuitable for 
the demands of a metropolitan network” and introduce a 
continuous-variable (CV) MDI-QKD protocol capable of pro¬ 
viding key rates which, they claim, are “three orders of mag¬ 
nitude higher” than those of DV-MDI-QKD. We believe, how¬ 
ever, that such statements are unjustified as they are based 
on an unfair comparison between the two platforms. Here, 
we show that, with a fair comparison, the secret key rate of 
DV-MDI-QKD with high-efficiency single-photon detectors 
(SPDs) and good system alignment is typically rather high 
and thus highly suitable for not only long-distance communi¬ 
cation but also metropolitan networks. The claimed very low 
key rate of DV-MDI-QKD in [1] was due to a combination 
of pessimistic assumptions of low-efficiency SPDs and rather 
high quantum bit error rate (QBER). 

It is well-known that CV-QKD could offer higher key rates 
than DV-QKD at relatively short distances [3], while the exact 
enhancement factor depends on technology. In their work, Pi¬ 
randola et al. [1] consider nearly perfect devices for CV-MDI- 
QKD (i.e., a relay with overall detection efficiency rj = 98% 
and an excess noise e ~ 0.01), but, rather surprisingly, use 
low-performance off-the-shelf fiber-optical components with 
t] — 14.5% and QBER = 2.94% (which corresponds to the 
misalignment error of 1.5% assumed in [2]) for DV-MDI- 
QKD. Such comparison is unfair as it ignores the existence of 
high-efficiency SPDs (rj = 93% [4]) and much lower achieved 
QBER (0.25% [5]), which could easily be used in DV-MDI- 
QKD. In addition, they evaluate the most favourable case for 
CV-MDI-QKD with a relay located very close to the sender 
(see Eig. 5d in ref. [1]), which is not necessarily the case in a 
real network. In doing so, it is not surprising that the enhance¬ 
ment factor is noteworthy. 

Here, we would like to point out that the situation changes 
significantly with better SPDs [4] and lower QBER [5] in 
DV-MDI-QKD. Eor CV-MDI-QKD, we use the same opti¬ 


mistic assumptions on the experimental parameters employed 
in ref. [1]. We first consider the highly asymmetric case where 
the relay is placed very close to one of the users, Alice, so that 
there is no channel loss between Alice and the relay. Eigs. la 
and lb illustrate this scenario in the asymptotic limit of an in¬ 
finitely long key (see Appendices for further details). In this 
case, at a typical metropolitan distance (say 20 km of standard 
telecom fiber of loss 0.2 dB/km used as an example in [1]), 
the key rate of DV-MDI-QKD is about 0.02 bits/use, which 
is actually quite high (i.e., approximately two orders of mag¬ 
nitude away from the fundamental limit [6]) and suitable for 
metropolitan networks. Moreover, this result is only slightly 
lower but comparable to that of CV-MDI-QKD. Notice that, 
even in this asymmetric case, the advantage in key rate of CV- 
MDI-QKD is less than one order of magnitude for total system 
loss beyond about only 2.5 dB. 

In a general network, it is quite likely that a relay is far 
away from both users. In the symmetric case where the re¬ 
lay is placed in the middle between them, we see that DV- 
MDI-QKD compares favorably with CV-MDI-QKD. This is 
illustrated in Eigs. Ic and Id (see Appendices for further de¬ 
tails). As shown there, while the key rate of DV-MDI-QKD 
is still about 0.02 bits/use at 20 km of telecom fiber, the key 
rate of CV-MDI-QKD drops to zero at already about 6.25 km. 
Indeed, due to optical fiber loss the maximum distance of CV- 
MDI-QKD is already limited to about 7.6 km (1.52 dB) [1]. 
Note that the performance of a network with arbitrary con¬ 
figuration will be between the asymmetric and the symmetric 
cases. 

It is worthy to mention as well several practical challenges 
associated with CV-MDI-QKD. Eirst, the outstanding exper¬ 
imental data from ref. [1] comes from a proof-of-principle 
demonstration where Alice and Bob are very close to each 
other, thus bypassing one of the major experimental chal¬ 
lenges in CV-MDI-QKD implementations—establishing a re¬ 
liable phase reference between two spatially separated users. 
Note that the Bell state measurement of DV-MDI-QKD is 
insensitive to phase noise [5], thus much easier to imple- 
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FIG. 1: Secret key rate of DV-MDI-QKD (green dashed line) versus CV-MDI-QKD (blue solid line). For the former we consider rj — 93% [4], 
QBER= 0.25% [5], and an error correction inefficiency factor of 1.16. For the later we use experimental parameters from ref. [1] (i.e., 
rj = 98%, £ ~ 0.01, and reconciliation efficiency ^ = 0.97). a, Asymmetric scenario with a relay located close to Alice. The solid blue 
line corresponds to Fig. 5d(i) in ref. [1]. We see that the advantage in key rate of CV-MDI-QKD is less than one order of magnitude for total 
system loss beyond about only 2.5 dB. b, A zoom-in of a for the low loss regime, c. Symmetric scenario with a relay placed in the middle 
of the users. This result seems to indicate that CV-MDI-QKD is unsuitable for applications in a symmetric case as the key rate drops to zero 
at already about 1.25 dB. Indeed, due to optical fiber loss the maximum distance of CV-MDI-QKD is already limited to about 7.6 km (1.52 
dB) [1]. d, As in b, but now referred to c. 


ment. Second, coupling losses and state-of-the-art hotnodyne 
detectors could render it difficult to achieve p = 98% for 
fiber-based CV-MDI-QKD communications at telecom wave¬ 
lengths (e.g., T] is about 60% in ref. [7]). Third, in the realistic 
finite-key length regime, current composable security proofs 
against general attacks for CV-QKD with coherent states seem 
to fall short on providing useful finite-size key estimates [8]. 
This strongly contrasts with DV-MDI-QKD [9]. Finally, if 
one considers the key rate per second, currently the high rep¬ 
etition rate of DV-QKD (i.e., 1 GHz [10]) versus CV-QKD 
(i.e., 1 MHz [7]) means that DV-QKD has an advantage in 
this regard. 

All these factors combine to lead us to conclude that, con¬ 
trary to the claims of Pirandola et al. [1], DV-MDI-QKD has 
a high key rate and is highly versatile and suitable for most 
metropolitan network configurations. Moreover, experimen¬ 
tal DV-MDI-QKD has already been done even at a distance 
of 200 km over telecom fibers [5]. CV-MDI-QKD has the 
potential for applications in some (e.g., highly asymmetric) 
metropolitan network configurations, but fares poorly in a 
symmetric network setting when a relay is far away from both 
users. Furthermore, a number of challenges including finite- 
key analysis with composable security, establishing a reliable 
phase reference between two remote users and low repetition 
rate need to be overcome before CV-MDI-QKD can be se¬ 


curely deployed in practice. 
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Appendix A: DV-MDI-QKD 

Here, we present the detailed models that we use for the 
numerical simulations of DV-MDI-QKD shown in Eig. 1 . 

The secure key rate of decoy-state DV-MDI-QKD in the 





















3 


asymptotic limit of an infinitely long key is given by [2] 

Rdv = PiiY^[l - i?2(e^i)] - Q'^fe{E'^)H2{E'^), (Al) 

where denotes the joint probabil¬ 

ity that both Alice and Bob generate a single-photon pulse, 
and with pA and pB being, respectively, the intensity of Al¬ 
ice and Bob’s signal states; the parameters and are, 
respectively, the yield in the rectilinear (Z) basis and the er¬ 
ror rate in the diagonal (X) basis, given that both Alice and 
Bob send single-photon states; H 2 {x) = —a:log 2 {x) — (1 — 
x) log 2 (1 — a;) is the binary Shannon entropy function; the 
terms and E"^ denote, respectively, the overall gain and 
quantum bit error rate (QBER) in the Z basis when both Al¬ 
ice and Bob emit a signal state; and fe{E^) > 1 is the error 
correction inefficiency function. 

The quantities and E^ are directly measured in the ex¬ 
periment, while Y^i and efi can be estimated using the decoy- 
state method [11]. Importantly, it has been shown that the use 
of two decoy states is already enough to obtain a tight estima¬ 
tion for Yii and [12]. 

To model experimental errors, we employ the method 
proposed in ref [11] for polarisation encoding DV-MDI- 
QKD [13, 14]. See also refs. [15, 16] for alternative models 
suitable for time-bin encoding systems [17, 18]. In particular, 
we use two unitary operators, located at the input arms of the 
beamsplitter within the relay (see Appendix B in ref. [11]), 
to simulate the intrinsic error rate, denoted as Cd, due to the 
misalignment and instability of the optical system. In addi¬ 
tion, we consider threshold SPDs with detection efficiency pd 
and dark count rate Yq. Furthermore, for simplicity, we con¬ 
sider the asymptotic case where Alice and Bob use an infinite 
number of decoy states. As already mentioned, the practical 
situation with a finite number of decoy settings provides sim¬ 
ilar results [12]. In this scenario, we have that the parameters 
Y^i and efi have the form [11] 
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where the parameters fli and are given by 


fli = 2e-=(l-Fo)" Ioi/3) + loiP - 2l3ed) 


(A4) 
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with Iq {x) being the modified Bessel function, and where 

7 = (pa?7a + AtB?7B)T?d, (A5) 

/3 = Vdy/JdAjJdiVAmi, 

X = /3\/ed(l - ed), 

w = flA7Af?d + ed(MB??B - MA?7A)t?d- 


7d ed To /e(g^) 

93% [4] 0.1% [5] 10~'^ [4] 1.16 [19] 

TABLE I: Experimental parameters considered in DV-MDI-QKD. 

In our simulation, we employ the experimental parameters 
shown in Table I. That is, we consider high-efficiency WSi 
superconducting nanowire single-photon detectors (SNSPDs) 
with rjd = 93% and Yq = 10“® (per pulse) [4], and as¬ 
sume an intrinsic error rate Cd = 0.1% (which corresponds 
to the QBER of 0.25% obtained in the 200 km DV-MDI- 
QKD experiment reported in ref. [5]). In addition, we use 
/e(i3^) = 1.16 [19]. The resulting lower bound on the secret 
key rate i?Dv given by Eq. (Al) is illustrated in Fig. 1 in the 
main text, where we have numerically optimised the values of 
the intensities pA and /tb- That is, for a given total system 
loss, we use a Monte Carlo simulation method to select the 
value of /iA and /tb such that i?Dv is maximum. 

To conclude this section, let us emphasise that the high- 
efficiency SNSPDs reported in ref. [4] have been already suc¬ 
cessfully applied in various recent QKD demonstrations such 
as high-dimensional QKD [20, 21] and a proof-of-principle 
demonstration of DV-MDI-QKD [22]. 


where r/A (pb) denotes the channel transmittance from Alice 
(Bob) to the relay. That is, pA — 10““*^/^°, where a is the 
loss coefficient of the channel that connects Alice with the 
relay measured in dB/km, and I a is the length of this channel 
measured in km. The definition of p-g, is analogous. Moreover, 
we have that Y^ = . 

For simulation purposes only, we use the value of and 
E'^ provided in Appendix B of ref. [11]. For completeness, 
we include the mathematical expressions below. In particular, 

^ 2 ); (A3) 


fit -|- iX,2 


Appendix B: CV-MDI-QKD 

In this Appendix we present the detailed models that we 
use for the numerical simulations of CV-MDI-QKD shown in 
Fig. 1. 

To evaluate the secure key rate of CV-MDI-QKD we follow 
Section E from the Supplementary Information of ref [1]. We 
have that the general expression of the key rate formula has 
the form 

i?cv = e-^AB - /e, (B1) 

where ^ is the reconciliation efficiency of the error correction 
code, and Iab and Ig denote, respectively, Alice and Bob’s 
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mutual information and Eve’s stolen information on Alice’s 
key. 

To derive an explicit formula for the secret key rate given 
by Eq. (Bl), Pirandola et al. [1] consider a “realistic Gaussian 
attack against the two links”, which definitively provides an 
upper bound on the secure key rate. Here, we assume the 
most favourable situation for CV-MDI-QKD by considering 
that such realistic Gaussian attack is indeed optimal and the 
resulting key rate is achievable. In doing so, we have that the 
quantity /ab can be expressed as [ 1 ] 

Jab = logs 


Pd £ 0 C 

98% 0.01 60 0.97 

TABLE II: Experimental parameters considered in CV-MDI- 
QKD [1]. 


Appendix C: TGM bound 

The secret key rates obtained in the previous sections can 
be compared with the fundamental upper bound (per optical 
mode) for coherent-state QKD provided in ref. [ 6 ] (so-called 
TGW bound). This bound has the form 


where (j) is the modulation variance in shot-noise units and % 
represents the so-called equivalent noise. 

Moreover, for simplicity, we consider the key rate in the 
limit of large modulation (</) 3> 1). In this scenario, and con¬ 
sidering first the asymmetric case rjA ^ Pb, we have that Ie is 
given by [ 1 ] 


Ie = h{l3) + log2(7) - h{6), (B3) 

where the parameters /3, 7 and 6 have the form 

VAVBX - (pa + Pb)^ 

Ipa - PbKpa + Pb) 
e|pA-PB|(<^+l) 

2 (pa + pb) 

PAX - (PA + Pb) 

PA + Pb 

Here, the term e denotes Euler’s number, and the equivalent 
noise x is given by 


/3 = 

7 = 
(5 = 


_ 2(pa + Pb) , 

X —-f 

PAPBPd 


(B5) 


with e being the excess noise. Einally, the function h{x), 
which appears in Eq. (B3), has the form 



In the symmetric case where rjA = r]B = p, we have that 
Ie is given by [ 1 ] 


Ie = log2 


^ e^(x-4)(0+l) ^ 


/i (I - 1 ) , (B6) 


i?TGw^log 2 + . (Cl) 

V1 - PAPB/ 

It can be shown, for instance, that at a typical metropolitan dis¬ 
tance (say 20 km of standard telecom fiber of loss 0.2 dB/km 
used as an example in [1]), the key rate of DV-MDI-QKD is 
approximately two orders of magnitude away from this fun¬ 
damental limit. 


Appendix D: Source requirements in CV-MDI-QKD 

Here, we briefly discuss challenges associated with the state 
preparation process in CV-MDI-QKD. 

As already mentioned in the main text, the experimental 
configuration using one laser feeding two closely spaced Al¬ 
ice and Bob on the optical table bypasses one of the major 
experimental challenges in CV-MDI-QKD, namely, establish¬ 
ing a reliable phase reference between two remote users. Even 
if a common laser is used for both Alice and Bob, distributing 
phase-stable signals over fibre to two remote sites can still be 
a practical challenge. 

Eurthermore, it is important to emphasise that one funda¬ 
mental assumption in MDI-QKD is that Eve cannot interfere 
with Alice and Bob’s state preparation processes [2]. To jus¬ 
tify the above assumption, DV-MDI-QKD is commonly im¬ 
plemented by using independent laser sources for Alice and 
Bob. However, since the proof-of-principle demonstration in 
ref [ 1 ] uses a common laser source for both of them, this 
might open the door for side-channel attacks on quantum state 
preparation. This is because at least one of the users has to en¬ 
code information on untrusted laser pulses accessible by Eve. 

Pirandola et ai [1] discussed several potential solutions to 
the above problems in the Supplementary Information. How¬ 
ever, none of them has been implemented in ref. [ 1 ]. 


where the equivalent noise x has now the form 

X = — + £. (B7) 

VVd 

In the simulation shown in Eig. 1 in the main text, we con¬ 
sider the same experimental parameters used in ref. [1]. They 
are illustrated in Table II. 


Appendix E: Addendum 

In this Appendix, we comment on a recent reply by Piran¬ 
dola et al [23] to this paper. In particular, 

1. Pirandola et al. agree with our main point. 

Eirst of all, it is important to note that in their reply Piran¬ 
dola et al. [23] agree with our main point. That is to say that. 
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contrary to the statements in their Nature Photonics paper [1], 
the secret key rate of DV-MDI-QKD with high-efficiency 
SPDs and good system alignment is sufficiently high for not 
only long distance communication but also metropolitan net¬ 
works. In fact, at metropolitan distances (say 20 km or more) 
in telecom fibers (with a loss of 0.2 dB/km at 1550 nm wave¬ 
length), the key rate of DV-MDI-QKD is only approximately 
two orders of magnitude away from the fundamental limit set 
by the TGW bound [ 6 ]. 

The validity of this main point relies mainly on the exis¬ 
tence of high-efficiency SPDs at telecom wavelengths, which 
not only have been used by a few research groups in the world 
in different recent experiments [4, 20-22, 24], but also are 
already commercially available [25, 26]. These detector sys¬ 
tems have “fully-automated closed-cycle cryostats that deliver 
temperatures below IK without the consumption and running 
expense of liquid helium” [25]. 

Most importantly, note that our main point holds indepen¬ 
dently of the performance of CV-MDI-QKD [1]. For com¬ 
pleteness, however, below we address some other side points 
raised by Pirandola et al. in [23]. 

2. Experimental results of CV-MDI-QKD done in 
free-space, at a non-telecom wavelength, and using non¬ 
telecom detectors cannot and should not he used as a 
demonstration of telecom CV-MDI-QKD performance. 

In [1], Pirandola et al. performed a table-top free-space ex¬ 
periment using a single laser at a wavelength of 1064 nm that 
lies far away from the telecom band. Experimental results 
obtained under such conditions, however commendable, can¬ 
not be used to make quantitative statements about a realistic 
CV-MDI-QKD experiment that would be carried out in fiber 
using two remotely located, independent, lasers at a telecom 
wavelength (say 1550 nm) using telecom photodetectors. 

As will be discussed below in a point-by-point manner (see 
Points 5 & 6 ), we find such attempts to infer results from en¬ 
tirely different experimental platforms and conditions inap¬ 
propriate and misleading. 

3. CV-MDI-QKD could have an advantage over DV- 
MDI-QKD only under rather restrictive conditions. 

We do not deny that CV-MDI-QKD might have an advan¬ 
tage over DV-MDI-QKD, but only in a rather restrictive pa¬ 
rameter space where a combination of assumptions/conditions 
are simultaneously satisfied, namely, (i) asymptotic key rate 
for an infinitely long key; (ii) high-efficiency (well above 
85%) homodyne detectors, (iii) highly asymmetric configu¬ 
ration where the relay is close to one of the two users, Alice 
or Bob; and (iv) low loss (i.e., short distance). 

We encourage serious and careful future theoretical and ex¬ 
perimental research in CV-MDI-QKD to address the above 
relevant challenges. However, it is important to put things in 
perspective and understand the nature of these relevant chal¬ 
lenges now. 

4. For CV-QKD with coherent states, practical compos- 
ahle secure key rates against the most general type of at¬ 
tacks have yet to he shown. 

It is important to clearly emphasise as well that the only rel¬ 
evant practical comparison between DV-MDI-QKD and CV- 
MDI-QKD is in the realistic finite-key setting scenario (not in 


the unrealistic infinitely long key situation). In this respect, 
Pirandola et al. [23] confuse the restricted class of collec¬ 
tive attacks with the most general class of coherent attacks. 
Indeed, CV-QKD can produce composable secure key rates 
against collective attacks with a reasonable amount of signals 
distributed between Alice and Bob [ 8 ]. Unfortunately, how¬ 
ever, current security proofs against the most general type of 
coherent attacks for CV-QKD with coherent states deliver ba¬ 
sically zero key rate for any reasonable amount of signals [ 8 ]. 
Indeed, as already noted in a recent review on CV-QKD, com¬ 
posable security against coherent attacks “has yet to be shown 
with coherent states” (see line 2 of the first paragraph of p. 10 
of [27]). 

This strongly contrasts with DV-MDI-QKD, which can pro¬ 
duce relatively high key rates composable secure against gen¬ 
eral attacks [9]. Also, note that, in this scenario, the minimum 
number of signals that Alice and Bob need to distribute de¬ 
pends on the transmittance of the system. For instance, it can 
be shown that when the detection efficiency of the relay is say 
rj = 14.5%, the minimum number of signals is about 10^°, 
while for p = 55% (77 = 93%) this number is 10® (10®) sig¬ 
nals [9]. In short, in reality, against the most general type of 
attacks, current finite-key security proofs provide basically no 
key rate for CV-MDI-QKD but deliver a relatively high key 
for DV-MDI-QKD. 

This being said, from now on we relax this assumption and 
consider the asymptotic key rate in the limit of infinitely long 
keys. 

5. The critical dependence of CV-MDI-QKD key rates 
on homodyne detection efficiency is down played by Piran¬ 
dola et al. 

The performance of fiber-based CV-MDI-QKD depends 
crucially on the value of the detection efficiency of homodyne 
detectors at telecom wavelengths. This is because, in an MDI- 
QKD setting, the relay cannot be assumed to be honest and its 
detection efficiency can be fully exploited by Eve. Therefore, 
the difference between rj = 98% and 77 = 80% can make or 
break the system. 

For instance, the key rate (even in the asymptotic limit) of 
CV-MDI-QKD [1] is basically zero when 77 < 85%, while 
DV-MDI-QKD can in principle tolerate about 40 dB loss [2]. 
Figs. 2a and 2b show the key rate of CV-MDI-QKD for several 
values of 77 > 85%. These figures highlight the dramatical 
performance decrease of CV-MDI-QKD even when 77 is as 
high as 90%. Pirandola et al. [1, 23] use rj = 98% for all 
the graphics that illustrate the key rate of CV-MDI-QKD. For 
this, they argue that [23] “CV Bell detections routinely reach 
very high efficiencies, as typical in many experiments [28-31] 
(77 = 98% in our setup)”. Unfortunately, neither the detectors 
in their setup nor the ones in the references provided were 
fiber-coupled or in telecom wavelength. 

In addition, they claim [23] that “in a fibre-optic implemen¬ 
tation of the protocol, coupling efficiency to a fibre can be as 
high as 98-99% and the quantum efficiency of photo-detectors 
can be >99%, with an overall efficiency of about 97-98%.” 
Unfortunately again, Pirandola et al. [23] seem to have ig¬ 
nored the difference between “can be” and “is”. While there is 
no fundamental limit for detectors to reach 97-98% efficiency. 
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CV-MDI-QKD (Asymmetric scenario) b CV-MDI-QKD (Symmetric scenario) 




FIG. 2: Secret key rate of CV-MDI-QKD in the asymptotic limit of infinitely long keys for different values of 77 > 85%. Like in Fig. 1, we 
consider e ~ 0.01, and a reconciliation efficiency ^ = 0.97. a, Asymmetric scenario with a relay located close to Alice, b, Symmetric scenario 
with a relay placed in the middle of the users. The blue lines correspond to the cases illustrated in Fig. 1 (i.e., r] = 98%). The key rate of 
CV-MDI-QKD is basically zero when 77 < 85% both for the asymmetric and symmetric configurations. This figure highlights the dramatical 
performance decrease of CV-MDI-QKD even when 77 is as high as 90%. 


most commercial off-the-shelf fiber-coupled detectors for the 
telecom wavelength have responsivities less than 1 A/W. This 
number translates into a detection efficiency at 1550 nm of 
77 < 80%, which is well below the minimum efficiency of 
about 85% required in CV-MDI-QKD. 

6. Pirandola et al. ’s free-space experiment is not a prop¬ 
erly designed QKD demonstration, thus the results shown 
in Fig. 1 are all “purely-numerical”. 

In addition, one might want to point out that the experiment 
reported in [1] is not a properly designed QKD demonstration, 
thus it is not appropriate to compare such result with lab and 
field fiber-based experiments [5, 13, 14, 17, 18, 32] in com¬ 
plete DV-MDI-QKD over practical distance at all. This is so, 
because; 

1. One single laser: As already mentioned in the main text 
(see also Appendix D), the experiment in [1] uses one 
laser (with Alice and Bob very close to each other) to 
mimic two independent lasers, thus bypassing the chal¬ 
lenge of establishing a phase reference between two re¬ 
mote lasers, and therefore results in much less excess 
noise than would be expected had they used two inde¬ 
pendent lasers. 

In this regard, Pirandola et al. [23] claim that “in¬ 
terfering signals from independent laser sources is no 
longer a security issue or major experimental challenge 
in CV-QKD” due to the recent developments in [33, 34]. 
While it is true that a potential solution to this prob¬ 
lem has been proposed recently, note that this solution 
has not been implemented in [ 1 ] nor the additional ex¬ 
pected phase noise has been considered in the simula¬ 
tions shown in refs. [1, 23]. 

2. Table-top experiment at a wavelength outside the tele¬ 
com band: It is a table-top experiment conducted at 
1064 nm through free-space. To use results obtained 
this way and plot the key rate as a function of the dis¬ 


tance (not loss) assuming 0.2 dB/km loss in fiber, as 
done in Fig. 5d [1] and in Fig.l [23], is entirely inap¬ 
propriate. The loss in fiber at 1064 nm is approximately 
1.5 dB/km. In fact, 1064 nm is shorter than the cut-off 
wavelength of the standard telecom fiber, meaning that 
the fiber does not support single mode propagation at 
1064 nm. 

3. Incorrect noise model: Pirandola et al. [23] claim that 
“Finally, the excess noise in the experiment (« 0.01) 
is not low but typical (e.g., it is 0.008 in [7]).” This is 
simply incorrect. 

In CV-QKD, there are two major contributions to the 
overall excess noise: (i) the phase noise in coherent de¬ 
tection (which can also include noise in state prepara¬ 
tion), and (ii) the electrical noise of the detector. In 
ref. [7], the electrical noise itself is already 0.015, al¬ 
most twice as the value of 0.008 interpreted in [23]. 

The reasons to observe a so small excess noise (« 0.01) 
in the experiment reported in [1] are, in our opinion, 
mainly two. First, the use of one single laser over a 
very short distance (see Point 6.1), thus the phase noise 
can be minimised. Second, the information provided 
in the supplementary material of [1] suggests that the 
bandwidth of the homodyne detectors could be rela¬ 
tively small. In this condition, such results cannot be 
directly translated to high-speed CV-MDI-QKD. 

In this regard, we would like to point out that the results 
shown in Fig. 1 are all “purely-numerical”. In particular, we 
consider a quite favourable scenario for CV-MDI-QKD by as¬ 
suming that; (i) a reliable phase relation can be established 
between two remote lasers without introducing any noise; and 
(ii) the loss of fiber coupling (required for fiber-based QKD) 
or for a free-space optical receiver (required in free-space 
QKD) is zero. Both assumptions are probably over-optimistic, 
so one might expect that the secure key rate of a complete 
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practical implementation of CV-MDI-QKD, when it is done, 
could be lower than that illustrated in Fig. 1 . In this sense, the 
lack of a CV-MDI-QKD demonstration that addresses all the 
points mentioned in this Appendix renders it difficult to make 
a “/a/r” comparison between both platforms. 

7. CV-MDI-QKD could be suitable only for particular 
network architectures. 

Suppose a metropolitan network architecture with several 
users connected to a single relay (e.g., see Fig. 9 in ref. [35]). 
Due to the limited performance of symmetric CV-MDI-QKD, 
to guarantee that all users can communicate with each other 
(without trusting any user in the network), note that most of 
them (but one) should be located relatively close to the relay. 

8. Final remarks. 

To conclude, we reply briefly to the statements that Piran- 
dola et al. [23] consider that are incorrect in our manuscript. 
In particular, 

1. ‘"The experimental rate of [1 ] is not an upper bound but 
a lower bound” [23]: Our manuscript does not claim 
that the experimental rate of [1] is an upper bound. 

2. “The theoretical rate of [1 ] is optimaF [23]: Note that 
Fig. I already assumes that the theoretical rate of [1] is 
optimal. This being said, we admit that it was unclear 
to us whether or not the “realistic Gaussian attack” con¬ 
sidered in [1] to derive the theoretical rate was indeed 
optimal, or if it provided an upper bound on the theoret¬ 
ical rate. So, in our simulations we opted for the most 


favourable case for CV-MDI-QKD by considering that 
the attack is optimal (see Appendix B). We are glad to 
see that Pirandola et al. [23] confirm this. 

3. “Finite-size effects [3, 36, 37] and composable secu¬ 
rity [8] support our experimental results” [23]: This 
statement is simply incorrect. See Point 4 above. 

4. “The relay doesn’t need to be in Alices lab” [23]: Our 
manuscript does not claim that the relay needs to be in¬ 
side Alice’s lab; in Fig. 1 we evaluate this case only be¬ 
cause it is the most favourable one for CV-MDI-QKD. 

5. “Interfering signals from independent laser sources is 
no longer a security issue or major experimental chal¬ 
lenge in CV-QKD” [23]: See Point 6 above. 

6 . “Fast time-resolved homodyne detectors are available 
with bandwidths of lOOMHz and more” [23]: None of 
the references provided by Pirandola et al. [23] to sup¬ 
port this statement are at telecom wavelengths, or have 
sufficiently high detection efficiency to deliver a signif¬ 
icant key rate for CV-MDI-QKD. Also, note that our 
statement in the main text about 1 MHz CV-QKD sim¬ 
ply reflects the state-of-the-art of current clock rates for 
complete CV-QKD systems [7], rather than the band¬ 
width of homodyne detectors. 


* Electronic address: fhxu@mit.edu 
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